In this article
Passkeys replace a typed password with a cryptographic sign-in credential, but you still need a recovery plan. Enable them on devices you control, understand where they are stored and test another way back into the account before retiring an existing sign-in method.
This is a documentation-based comparison. We have not tested every provider, device or recovery flow.
What changes when you use a passkey?#
With a password, you submit a shared secret. With a passkey, the sign-in uses a cryptographic credential and a local approval such as a device PIN or biometric check.
The FIDO Alliance explains that passkeys can be synchronized through a provider or bound to a particular device. They are designed to resist phishing. Your fingerprint is a way to unlock the credential, not a password you send to the website.
That changes a common attack path: there is no reusable account password to type into a convincing imitation login page. It does not make the rest of the device, account recovery system or signed-in session immune to compromise.
Where is your passkey stored?#
Before creating one, identify the provider or security key receiving it. A synchronized passkey may be available through that provider on other supported devices. A device-bound credential requires access to that device or key.
Do not assume a passkey automatically appears everywhere you use the same email address. Check compatibility and recovery instructions for the provider you choose.
If you plan to switch credential managers, read how to migrate password managers safely. Traditional password exports are not a universal solution for passkey portability.
Ask the lost-phone question first#
Imagine your phone becomes unavailable today. Can you sign in from a second device? Do you have a supported recovery method? Does recovery depend on an email account you can access only from that same phone?
This exercise exposes circular dependencies. For example, the recovery email for one account may depend on another account whose only sign-in device is also missing.
Make a short account map for your primary email, password manager and other important services. Record recovery routes without copying secrets into an ordinary shared document.
A safer setup sequence#
- Update your supported devices and browser.
- Check that the device lock is enabled and private.
- Read the account's current passkey and recovery instructions.
- Create a passkey on your own device.
- Test a normal sign-in.
- Test a supported second route while the original still works.
- Confirm how to remove a lost device's credential.
For Google Accounts, the official passkey instructions explain device requirements and setup. They also state that adding a passkey does not remove existing authentication or recovery factors. An employer-managed account can have different policies.
Avoid shared-device surprises#
Do not create your personal passkey on a public or shared computer. Someone who can unlock an eligible device may be able to use credentials stored there, subject to the provider's flow.
For families or shared equipment, separate operating-system accounts and follow the credential provider's guidance. A convenient sign-in should not quietly become shared account access.
Do passkeys mean passwords are obsolete everywhere?#
No. Services differ in support, recovery and compatibility. You may still need unique passwords and other account protections for services without suitable passkey support.
Choose based on the account's actual capabilities. Network privacy tools solve a different problem: our VPN limitations guide explains why a VPN cannot replace secure account authentication.
Passkeys are most useful when you pair easier sign-in with a recovery route you have actually checked.